CVE-2026-63986
Received Received - Intake

ethtool genlmsg_cancel Use-After-Free in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure The goto err label leads to: genlmsg_cancel(skb, ehdr); return ret; If ethnl_tsinfo_prepare_dump() failed, it has not started a genlmsg. There's nothing to cancel, and passing an error pointer to genlmsg_cancel() would cause a crash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63986
EUVD
EUVD-2026-45759

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel ethtool *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a bug in the ethtool subsystem. When preparing to dump timestamp information, a failure occurs before starting a generic netlink message. The error handling incorrectly passes an error pointer to genlmsg_cancel(), which attempts to cancel a message that was never started. This leads to a crash.

Detection Guidance

This vulnerability is specific to the Linux kernel's ethtool subsystem and requires kernel-level detection. There are no direct network or system commands to detect it as it is a code-level issue. Monitoring kernel logs for crashes or errors related to ethtool or genlmsg_cancel may indicate exploitation or impact.

Impact Analysis

If exploited, this vulnerability could cause a system crash or kernel panic, leading to denial of service. Systems using affected versions of the Linux kernel with ethtool functionality may become unresponsive or require a reboot.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue related to a crash in the ethtool subsystem when handling certain error conditions. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Apply the latest Linux kernel patches or updates that address this vulnerability. If you are using a vulnerable kernel version, upgrading to a patched version is the recommended mitigation. No temporary workarounds are suggested in the provided context.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63986. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart